Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
OpenHarmony
Startup Init Lite
提交
487bebe2
S
Startup Init Lite
项目概览
OpenHarmony
/
Startup Init Lite
12 个月 前同步成功
通知
3
Star
37
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
S
Startup Init Lite
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
未验证
提交
487bebe2
编写于
11月 22, 2022
作者:
O
openharmony_ci
提交者:
Gitee
11月 22, 2022
浏览文件
操作
浏览文件
下载
差异文件
!1534 fix:修复seccomp模块内存泄漏问题
Merge pull request !1534 from 夏不白/seccomp_fix_secure
上级
6739b34b
fc954bb4
变更
1
隐藏空白更改
内联
并排
Showing
1 changed file
with
93 addition
and
27 deletion
+93
-27
services/modules/seccomp/seccomp_policy.c
services/modules/seccomp/seccomp_policy.c
+93
-27
未找到文件。
services/modules/seccomp/seccomp_policy.c
浏览文件 @
487bebe2
...
@@ -26,6 +26,7 @@
...
@@ -26,6 +26,7 @@
#include <linux/audit.h>
#include <linux/audit.h>
#include <linux/seccomp.h>
#include <linux/seccomp.h>
#include <linux/filter.h>
#include <linux/filter.h>
#include <limits.h>
#ifndef SECCOMP_SET_MODE_FILTER
#ifndef SECCOMP_SET_MODE_FILTER
#define SECCOMP_SET_MODE_FILTER (1)
#define SECCOMP_SET_MODE_FILTER (1)
...
@@ -39,6 +40,13 @@
...
@@ -39,6 +40,13 @@
#define FILTER_NAME_FORMAT "g_%sSeccompFilter"
#define FILTER_NAME_FORMAT "g_%sSeccompFilter"
#define FILTER_SIZE_STRING "Size"
#define FILTER_SIZE_STRING "Size"
typedef
enum
{
SECCOMP_SUCCESS
,
INPUT_ERROR
,
RETURN_NULL
,
RETURN_ERROR
}
SeccompErrorCode
;
static
bool
IsSupportFilterFlag
(
unsigned
int
filterFlag
)
static
bool
IsSupportFilterFlag
(
unsigned
int
filterFlag
)
{
{
errno
=
0
;
errno
=
0
;
...
@@ -75,43 +83,101 @@ static bool InstallSeccompPolicy(const struct sock_filter* filter, size_t filter
...
@@ -75,43 +83,101 @@ static bool InstallSeccompPolicy(const struct sock_filter* filter, size_t filter
return
true
;
return
true
;
}
}
bool
SetSeccompPolicyWith
Name
(
const
char
*
filterName
)
static
char
*
GetFilterFileBy
Name
(
const
char
*
filterName
)
{
{
char
filterLibPath
[
512
]
=
{
0
};
size_t
maxFilterNameLen
=
PATH_MAX
-
strlen
(
FILTER_LIB_PATH_FORMAT
)
+
strlen
(
"%s"
)
-
1
;
char
filterVaribleName
[
512
]
=
{
0
};
if
(
filterName
==
NULL
&&
strlen
(
filterName
)
>
maxFilterNameLen
)
{
struct
sock_filter
*
filterPtr
=
NULL
;
return
NULL
;
size_t
*
filterSize
=
NULL
;
}
char
filterLibPath
[
PATH_MAX
]
=
{
0
};
int
rc
=
snprintf_s
(
filterLibPath
,
sizeof
(
filterLibPath
),
\
int
rc
=
snprintf_s
(
filterLibPath
,
sizeof
(
filterLibPath
),
\
strlen
(
filterName
)
+
strlen
(
FILTER_LIB_PATH_FORMAT
)
-
strlen
(
"%s"
),
\
strlen
(
filterName
)
+
strlen
(
FILTER_LIB_PATH_FORMAT
)
-
strlen
(
"%s"
),
\
FILTER_LIB_PATH_FORMAT
,
filterName
);
FILTER_LIB_PATH_FORMAT
,
filterName
);
PLUGIN_CHECK
(
rc
!=
-
1
,
return
false
,
"snprintf_s filterLibPath failed"
);
if
(
rc
==
-
1
)
{
return
NULL
;
}
return
realpath
(
filterLibPath
,
NULL
);
}
rc
=
snprintf_s
(
filterVaribleName
,
sizeof
(
filterVaribleName
),
\
static
int
GetSeccompPolicy
(
const
char
*
filterName
,
int
**
handler
,
char
*
filterLibRealPath
,
struct
sock_fprog
*
prog
)
{
char
filterVaribleName
[
PATH_MAX
]
=
{
0
};
struct
sock_filter
*
filter
=
NULL
;
size_t
*
filterSize
=
NULL
;
void
*
policyHanlder
=
NULL
;
int
ret
=
SECCOMP_SUCCESS
;
do
{
int
rc
=
snprintf_s
(
filterVaribleName
,
sizeof
(
filterVaribleName
),
\
strlen
(
filterName
)
+
strlen
(
FILTER_NAME_FORMAT
)
-
strlen
(
"%s"
),
\
strlen
(
filterName
)
+
strlen
(
FILTER_NAME_FORMAT
)
-
strlen
(
"%s"
),
\
FILTER_NAME_FORMAT
,
filterName
);
FILTER_NAME_FORMAT
,
filterName
);
PLUGIN_CHECK
(
rc
!=
-
1
,
return
false
,
"snprintf_s faiVribleName failed"
);
if
(
rc
==
-
1
)
{
const
char
*
filterLibRealPath
=
realpath
(
filterLibPath
,
NULL
);
ret
=
RETURN_ERROR
;
PLUGIN_CHECK
(
filterLibRealPath
!=
NULL
,
return
false
,
"format filter lib real path failed"
);
break
;
}
void
*
handler
=
dlopen
(
filterLibRealPath
,
RTLD_LAZY
);
PLUGIN_CHECK
(
handler
!=
NULL
,
return
false
,
"dlopen %s failed"
,
filterLibRealPath
);
policyHanlder
=
dlopen
(
filterLibRealPath
,
RTLD_LAZY
);
if
(
policyHanlder
==
NULL
)
{
filterPtr
=
(
struct
sock_filter
*
)
dlsym
(
handler
,
filterVaribleName
);
ret
=
RETURN_NULL
;
PLUGIN_CHECK
(
filterPtr
!=
NULL
,
dlclose
(
handler
);
break
;
return
false
,
"dlsym %s failed"
,
filterVaribleName
);
}
filter
=
(
struct
sock_filter
*
)
dlsym
(
policyHanlder
,
filterVaribleName
);
if
(
filter
==
NULL
)
{
ret
=
RETURN_NULL
;
break
;
}
rc
=
strcat_s
(
filterVaribleName
,
strlen
(
filterVaribleName
)
+
\
strlen
(
FILTER_SIZE_STRING
)
+
1
,
FILTER_SIZE_STRING
);
if
(
rc
!=
0
)
{
ret
=
RETURN_ERROR
;
break
;
}
filterSize
=
(
size_t
*
)
dlsym
(
policyHanlder
,
filterVaribleName
);
if
(
filterSize
==
NULL
)
{
ret
=
RETURN_NULL
;
break
;
}
}
while
(
0
);
*
handler
=
(
int
*
)
policyHanlder
;
prog
->
filter
=
filter
;
if
(
filterSize
!=
NULL
)
{
prog
->
len
=
(
unsigned
short
)(
*
filterSize
);
}
rc
=
strcat_s
(
filterVaribleName
,
strlen
(
filterVaribleName
)
+
strlen
(
FILTER_SIZE_STRING
)
+
1
,
FILTER_SIZE_STRING
);
return
ret
;
PLUGIN_CHECK
(
rc
==
0
,
dlclose
(
handler
);
}
return
false
,
"strcat_s filterVaribleName failed"
);
filterSize
=
(
size_t
*
)
dlsym
(
handler
,
filterVaribleName
);
bool
SetSeccompPolicyWithName
(
const
char
*
filterName
)
PLUGIN_CHECK
(
filterSize
!=
NULL
,
dlclose
(
handler
);
{
return
false
,
"dlsym %s failed"
,
filterVaribleName
);
void
*
handler
=
NULL
;
char
*
filterLibRealPath
=
NULL
;
struct
sock_fprog
prog
=
{
0
};
bool
ret
=
false
;
filterLibRealPath
=
GetFilterFileByName
(
filterName
);
PLUGIN_CHECK
(
filterLibRealPath
!=
NULL
,
return
false
,
"get filter file name faield"
);
int
retCode
=
GetSeccompPolicy
(
filterName
,
(
int
**
)
&
handler
,
filterLibRealPath
,
&
prog
);
if
(
retCode
==
SECCOMP_SUCCESS
)
{
ret
=
InstallSeccompPolicy
(
prog
.
filter
,
prog
.
len
,
SECCOMP_FILTER_FLAG_LOG
);
}
else
{
PLUGIN_LOGE
(
"GetSeccompPolicy failed return is %d"
,
retCode
);
}
bool
ret
=
InstallSeccompPolicy
(
filterPtr
,
*
filterSize
,
SECCOMP_FILTER_FLAG_LOG
);
if
(
handler
!=
NULL
)
{
dlclose
(
handler
);
}
dlclose
(
handler
);
if
(
filterLibRealPath
!=
NULL
)
{
free
(
filterLibRealPath
);
}
return
ret
;
return
ret
;
}
}
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录